www: escape HTML in footer description

This isn't a security vulnerability since $GIT_DIR/description
is controlled by the admin; but it causes the footer to
misrender.

diff --git a/lib/PublicInbox/WWW.pm b/lib/PublicInbox/WWW.pm
index c25deff3117dfe576ec33719b4bc2cc17befbf20..78b8826e2287ae9cdd29a5d30cf4cdc695f2df32 100644 (file)
--- a/lib/PublicInbox/WWW.pm
+++ b/lib/PublicInbox/WWW.pm
@@ -15,6 +15,7 @@ use strict;
 use warnings;
 use Plack::Request;
 use PublicInbox::Config;
+use PublicInbox::Hval;
 use URI::Escape qw(uri_escape_utf8 uri_unescape);
 use constant SSOMA_URL => '//ssoma.public-inbox.org/';
 use constant PI_URL => '//public-inbox.org/';
@@ -255,6 +256,7 @@ sub footer {
 
        # auto-generate a footer
        chomp(my $desc = $obj->description);
+       $desc = PublicInbox::Hval::ascii_html($desc);
 
        my $urls;
        my @urls = @{$obj->cloneurl};